0

After half a day of reading about the correct way to encode passwords, I am overwhelm and I've chosen to do it this way. However I'm not sure whether this is the best way to do it. Thanks in advance.

$password= "abc123";
$salt = mcrypt_create_iv(32, MCRYPT_RAND);
$this_will_be_stored_in_db= crypt($password,$salt);
echo $this_will_be_stored_in_db;
Jian Short
  • 135
  • 1
  • 2
  • 13

1 Answers1

0

The thing is that crypt() is one-way hashing, which is not the same thing as encoding, so you won't be able to get the original value after you passed a value through that code. If hashing is what you want to do with the password, I would recommend using bcrypt. Here is an example of how you can implement it:

$password = 'secretPassword';
$salt = '$2a$13$'.substr(sha1($password),0,22); 
$hashed_value = substr(crypt($pass, $salt), 29);

You can read more about bcrypt on this site: http://www.nathandavison.com/posts/view/13/php-bcrypt-hash-a-password-with-a-logical-salt

DannyCruzeira
  • 564
  • 1
  • 6
  • 19